feat: validate rp_id matches default one

lib/webauthn/authenticator_attestation_response.rb

@@ -1,6 +1,7 @@
 # frozen_string_literal: true
 
 require "cbor"
+require "uri"
 
 require "webauthn/authenticator_data"
 require "webauthn/attestation_statement"
@@ -17,6 +18,7 @@ def valid?(original_challenge, original_origin)
  valid_type? &&
  valid_challenge?(original_challenge) &&
  valid_origin?(original_origin) &&
+ valid_rp_id?(original_origin) &&
  authenticator_data.valid? &&
  user_present? &&
  attestation_statement.valid?(authenticator_data, client_data.hash)
@@ -43,6 +45,12 @@ def attestation_statement
  WebAuthn::AttestationStatement.from(attestation["fmt"], attestation["attStmt"])
  end
 
+ def valid_rp_id?(original_origin)
+ domain = URI.parse(original_origin).host
+
+ Digest::SHA256.digest(domain) == authenticator_data.rp_id_hash
+ end
+
  def user_present?
  authenticator_data.user_present?
  end

spec/webauthn/authenticator_attestation_response_spec.rb

@@ -88,4 +88,54 @@
  end
  end
  end
+
+ describe "rp_id validation" do
+ let(:original_origin) { "https://localhost:3000" }
+ let(:challenge) {
+ Base64.urlsafe_encode64(SecureRandom.random_bytes(16))
+ }
+ let(:client_data_json) {
+ hash_to_encoded_json(challenge: challenge,
+ clientExtensions: {},
+ hashAlgorithm: "SHA-256",
+ origin: original_origin,
+ type: "webauthn.create")
+ }
+
+ let(:rp_id_hash) { Digest::SHA256.digest(rp_id) }
+ let(:auth_data) {
+ (rp_id_hash.bytes + [65, 0, 0, 0, 0]).pack('c*')
+ }
+ let(:attestation_object) {
+ hash_to_encoded_cbor(fmt: "none",
+ attStmt: {},
+ authData: auth_data)
+ }
+
+ context "matches the default one" do
+ let(:rp_id) { "localhost" }
+
+ it "is valid" do
+ response = WebAuthn::AuthenticatorAttestationResponse.new(
+ attestation_object: attestation_object,
+ client_data_json: client_data_json
+ )
+
+ expect(response.valid?(challenge, original_origin)).to be_truthy
+ end
+ end
+
+ context "doesn't match the default one" do
+ let(:rp_id) { "invalid" }
+
+ it "is invalid" do
+ response = WebAuthn::AuthenticatorAttestationResponse.new(
+ attestation_object: attestation_object,
+ client_data_json: client_data_json
+ )
+
+ expect(response.valid?(challenge, original_origin)).to be_falsy
+ end
+ end
+ end
 end